Privilege escalation on xrdp
Priority LOW 37CWE-191Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.
Summary
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00489 42nd percentileScored 2026-11-07
Fix Fixed xrdp (neutrinolabs): 0.9.18.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| neutrinolabs | xrdp | 0.9.17 to before 0.9.18.1 | 0.9.18.1 | Patch available | CNA |
- xrdp Vendorneutrinolabs Affected 0.9.17 to before 0.9.18.1 Fixed in 0.9.18.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:neutrinolabs:xrdp:0.9.17:*:*:*:*:*:*:* | 0.9.17 | Vulnerable | neutrinolabs |
| cpe:2.3:a:neutrinolabs:xrdp:0.9.18:*:*:*:*:*:*:* | 0.9.18 | Vulnerable | neutrinolabs |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
- cpe:2.3:a:neutrinolabs:xrdp:0.9.17:*:*:*:*:*:*:* Versions 0.9.17 Vulnerable ·neutrinolabs
- cpe:2.3:a:neutrinolabs:xrdp:0.9.18:*:*:*:*:*:*:* Versions 0.9.18 Vulnerable ·neutrinolabs
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA xrdp (neutrinolabs) Fixed in 0.9.18.1
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23613
References
More neutrinolabs Xrdp vulnerabilities
- TI-2025-42163 xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2026-29860 xrdp: lib_palette_update Heap Buffer Overflow & RCE CVSS 3.1CRITICAL 9.8
- TI-2022-07540 Buffer Overflow in xrdp CVSS 3.1CRITICAL 9.8
- TI-2022-07539 Buffer Overflow occurs in xrdp CVSS 3.1CRITICAL 9.8
- TI-2022-07538 Out of Bound Write in xrdp CVSS 3.1CRITICAL 9.8
- TI-2022-07537 Buffer Overflow in xrdp CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-23613 · CVE Program
- CVE-2022-23613 · NVD
- FIRST EPSS
- CVE-2022-23613 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences